EUVD-2026-68525Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP POST to GraphQL endpoint
-
DeliveryInclude field argument with large-exponent float literal
-
ExploitSmallRye coerces float to BigInteger without magnitude check
-
ExecutionJVM allocates enormous BigInteger object
-
PersistCPU saturates or heap exhausted
-
ImpactService crashes or becomes unresponsive
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Input size validation
|
| Exploitation Conditions | The target application must be built on Red Hat Build of Quarkus and must expose at least one GraphQL endpoint powered by SmallRye GraphQL that accepts a field typed as BigInteger (or a scalar that coerces to BigInteger) in its schema. No authentication is required (CVSS PR:N) and no special network position is needed (CVSS AV:N, AC:L). Exploitation is limited to availability impact only - the attacker cannot read data or modify state. Deployments that do not expose GraphQL endpoints, or that front GraphQL with an API gateway enforcing numeric input validation, are not exploitable via this vector. |
| Impact | The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the real-world risk: network-accessible, zero authentication, low complexity, and full availability impact. The attack is deterministic and requires no brute force, making it automatable at scale against any internet-exposed Quarkus GraphQL endpoint. EPSS data was not provided in the intelligence feed, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV and no POC repository was referenced, but the attack primitive is trivially derivable from the description - any developer familiar with GraphQL query syntax and Java BigInteger behavior could reproduce it. Impact is limited to availability (no confidentiality or integrity risk), which moderates the urgency compared to RCE-class flaws. However, a single malformed query can render the service unavailable, making this a meaningful operational risk for externally-facing APIs. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a single HTTP POST request to a Quarkus application's GraphQL endpoint containing a mutation or query that includes a BigInteger-typed argument with a value such as 1e2147483647. SmallRye GraphQL's scalar coercion attempts to instantiate a Java BigInteger from this float literal, triggering allocation of an object requiring gigabytes of heap, which either causes an OutOfMemoryError crashing the JVM process or saturates a CPU core during the conversion, rendering the service unavailable. No POC has been identified, but the attack requires no special tooling beyond a standard HTTP client. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 31, 2026
Denial of service in SmallRye GraphQL allows unauthenticated remote attackers to exhaust server CPU or heap memory by submitting a GraphQL query containing a large-exponent float literal (e.g., 1e999999999) that triggers unconstrained BigInteger allocation during scalar coercion. Affected deployments include any application built on Red Hat Build of Quarkus that exposes a GraphQL endpoint via SmallRye GraphQL. No public exploit or KEV listing has been identified at time of analysis, though the attack technique is trivially constructible from the public description.
RemediationAI
Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-76763 for the specific patched version of Red Hat Build of Quarkus - no exact fix version was provided in the available intelligence data, so upgrading to the latest Red Hat-released Quarkus build is the recommended first action. As a compensating control pending patch, deploy an API gateway or WAF rule that enforces maximum query payload size and rejects numeric literals exceeding a defined magnitude threshold (e.g., reject any exponent value above 1000). Additionally, configure GraphQL query complexity and depth limits using SmallRye GraphQL's built-in query protection features if available, which can limit the surface area for resource-exhaustion queries. Rate-limiting GraphQL endpoints per source IP provides a partial mitigation but does not prevent a single oversized query from causing damage before the limit activates.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SmallRye GraphQL is the GraphQL server implementation bundled with Red Hat Build of Quarkus (CPE: cpe:2.3:a:red_hat:red_hat_build_of_quarkus:*:*:*:*:*:*:*:*). The root cause is CWE-1284 (Improper Validation of Specified Quantity in Input): when the scalar coercion layer converts a GraphQL number literal to a Java BigInteger, it does not bound-check the magnitude of the input before performing the conversion. Float literals in GraphQL use IEEE 754 representation, allowing exponents that represent astronomically large values. A value like 1e2147483647 will cause Java's BigInteger to attempt allocation of hundreds of megabytes or gigabytes to store the integer representation, consuming both heap memory and CPU time during conversion. This class of flaw is closely related to 'algorithmic complexity' or 'decompression bomb' attacks applied to numeric parsing.
Know when Red Hat Build Of Quarkus gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable GraphQL endpoint, no auth, trivially exploitable single query; only availability impacted.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the allocation of extremely large BigInteger objects, causing CPU exhaustion or an OutOfMemoryError, resulting in a denial of service.
Executive ViewAI
SmallRye GraphQL components in Red Hat Quarkus applications are vulnerable to remote denial-of-service attacks via crafted numeric inputs, creating immediate availability risk for any organization using Quarkus GraphQL endpoints. No vendor patch is currently available, requiring urgent implementation of interim controls to prevent service disruption.
Implement GraphQL input validation (reject exponent floats above 100), enforce query complexity and depth limits at the resolver level, enable rate limiting on GraphQL endpoints, establish monitoring for anomalous CPU and heap memory spikes, and evaluate WAF rules to filter malformed numeric inputs. These controls substantially reduce attack surface pending vendor patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Red Hat Build Of Quarkus
View allUnauthenticated attackers can bypass security controls on REST endpoints generated by Quarkus REST Data Panache when a d
Server-side template injection in the Qute template engine's ReflectionValueResolver allows authenticated remote attacke
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
A remote, unauthenticated attacker can exhaust the JVM heap and cause a denial of service by sending a small crafted ima
Unbounded per-connection queue growth in Netty's WebSocketServerExtensionHandler lets unauthenticated remote attackers e
Improper handling of HTTP/2 and HTTP/3 Extended CONNECT requests in Netty-based services can downgrade them to ordinary
Unbounded remote-initiated stream creation in Netty's SpdySessionHandler allows an unauthenticated, network-positioned a
Unbounded heap memory consumption in Netty's HttpServerCodec (io.netty:netty-codec-http) lets a remote, unauthenticated
Quarkus HTTP security path-normalization discrepancy allows unauthenticated remote attackers to craft a URL that the sec
Remote unauthenticated attackers can exhaust memory in Netty-based services that parse PROXY protocol v2, due to a refer
Malformed HTTP/2 CONNECT stream injection in Red Hat JBoss EAP and the wider Red Hat middleware stack (Quarkus, Keycloak
Netty's codec-rtsp component silently normalizes away trailing control bytes in RTSP method tokens, so a wire request wh
GitHub PoC
Exploit-DB